NetSentry

Python-based network packet sniffer and basic intrusion detection system (IDS) built on Linux using Scapy. NetSentry captures live network traffic, analyzes DNS and HTTP protocols, detects suspicious network behavior, exports PCAP files, logs security events, and generates traffic statistics for basic SOC-style network monitoring.

Features

• Live packet capture
• TCP, UDP, and ICMP monitoring
• DNS query extraction
• Suspicious domain detection
• HTTP request analysis
• Suspicious HTTP path detection
• Behavioral port scan detection
• PCAP export
• Structured logging
• Traffic statistics and summary reports
• Command-line filtering
• Modular architecture

Architecture

Technologies

• Python 3.13
• Scapy
• Colorama
• Linux (Kali / Ubuntu)
• VS Code
• Git

Project structure

NetSentry/
├── src/
│   ├── sniffer.py
│   ├── detection_engine.py
│   ├── http_analyzer.py
│   ├── logger.py
│   └── utils.py
├── docs/
│   ├── architecture.md
│   ├── usage.md
│   ├── interview_questions.md
│   └── screenshots/
├── logs/
├── pcaps/
├── tests/
├── README.md
├── CHANGELOG.md
├── project_notes.md
├── requirements.txt
└── .gitignore

Installation

Clone the repository:

git clone https://github.com/Vishnu9604/NetSentry.git
cd NetSentry

Create a virtual environment:

python3 -m venv venv
source venv/bin/activate

Install dependencies:

pip install -r requirements.txt

Usage

Capture all traffic:

sudo venv/bin/python src/sniffer.py

Capture TCP traffic:

sudo venv/bin/python src/sniffer.py --tcp

Capture UDP traffic:

sudo venv/bin/python src/sniffer.py --udp

Capture ICMP traffic:

sudo venv/bin/python src/sniffer.py --icmp

Capture traffic for a specific port:

sudo venv/bin/python src/sniffer.py --port 53

Capture localhost traffic:

sudo venv/bin/python src/sniffer.py --tcp --iface lo

Screenshots

Startup

DNS detection

HTTP detection

Port scan detection

Capture summary

Detection capabilities

NetSentry currently detects:

• Suspicious DNS domains
• Suspicious HTTP paths
• Behavioral TCP port scans
• Basic reconnaissance activity
• Protocol-level traffic patterns

Future improvements

• HTTP response analysis
• TLS fingerprinting
• ICMP flood detection
• DNS tunneling detection
• Threat intelligence integration
• Real-time monitoring dashboard
• Mini SIEM integration
• Cloud log ingestion

Author

Vishnu Satam

Cybersecurity | Network Security | Python | SOC Analyst Projects